CVE-2026-38429

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-38429
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-38429.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-38429
Published
2026-05-05T00:00:00Z
Modified
2026-07-27T09:24:29.993866Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/38xxx/CVE-2026-38429.json",
    "cna_assigner": "mitre"
}
References

Affected packages

Git / github.com/alkacon/opencms-core

Affected ranges

Type
GIT
Repo
https://github.com/alkacon/opencms-core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e3e41e5a96d71383279e7d23c627efc9934008c1
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

Other
build_10_0_0
build_10_0_0_alpha_1
build_10_0_0_alpha_1u
build_10_0_0_alpha_2
build_10_0_0_beta
build_10_0_0_beta3
build_10_0_0_beta4
build_10_0_0_beta_2
build_10_5_0
build_10_5_0_1
build_10_5_0_2
build_10_5_0_3
build_10_5_0_beta
build_10_5_x_cmsdays
build_11_0_0_beta
build_11_0_0_beta_2
build_11_0_0_rc
build_12_0_0
build_13_0_0
build_14_0_0
build_15_0_0
build_16_0_0
build_17_0_0
build_18_0_0
build_19_0_0
build_20_0_0
build_4_7_10
build_4_7_11
build_4_7_12
build_4_7_13
build_4_7_14
build_4_7_6
build_4_7_8
build_4_7_9
build_5_0_0
build_5_0_0_beta_1
build_5_0_0_beta_2
build_5_0_0_rc_1
build_5_0_0_rc_2
build_5_1_0
build_5_1_1
build_5_1_10
build_5_1_11
build_5_1_12
build_5_1_3
build_5_1_4
build_5_1_5
build_5_1_6
build_5_1_7
build_5_1_8
build_5_1_9
build_5_3_1
build_5_3_3
build_5_3_4
build_5_3_5
build_5_3_6
build_5_5_1
build_5_5_2
build_5_5_3
build_5_5_4
build_5_7_1
build_5_7_2
build_5_7_3
build_5_9_1
build_5_9_2
build_6_0_0
build_6_0_1
build_6_0_2
build_6_0_3
build_6_0_4
build_6_0_5
build_6_1_13
build_6_2_0
build_6_2_1
build_6_2_2
build_6_2_3
build_7_0_0
build_7_0_1
build_7_0_2
build_7_0_4
build_7_3_0
build_7_5_0_beta_1
build_7_9_2
build_8_0_0
build_8_0_1
build_8_0_2
build_8_0_2_1
build_8_0_3
build_8_5_0
build_8_5_1
build_8_7_0
build_8_9_0
build_9_0_0
build_9_0_0_1
build_9_5_0

Database specific

vanir_signatures_modified 
"2026-07-27T09:24:29Z"
vanir_signatures 
[
    {
        "signature_type": "Function",
        "target": {
            "file": "src/org/opencms/importexport/CmsImportVersion3.java",
            "function": "importData"
        },
        "deprecated": false,
        "source": "https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1",
        "id": "CVE-2026-38429-0f1d98a8",
        "signature_version": "v1",
        "digest": {
            "function_hash": "150378459566197607171381904126069760216",
            "length": 1018.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "src/org/opencms/importexport/CmsXmlPageConverter.java"
        },
        "deprecated": false,
        "source": "https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1",
        "id": "CVE-2026-38429-2aca5ce8",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "145574074109000369493955727831983032494",
                "16640040146647270071345503687484714308",
                "169192263732467465202538910163828443427",
                "85988428784867084438144774304856970190",
                "318210125088655057575942019883947184609",
                "59071069497845359753083566457126727257",
                "247471594557108826914438128328516223540",
                "240140326639279127449893358793276776823"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "src/org/opencms/importexport/CmsImportVersion5.java",
            "function": "importData"
        },
        "deprecated": false,
        "source": "https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1",
        "id": "CVE-2026-38429-53319ecd",
        "signature_version": "v1",
        "digest": {
            "function_hash": "164464879669006136806220302618854857961",
            "length": 1194.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "src/org/opencms/importexport/CmsImportVersion4.java",
            "function": "importData"
        },
        "deprecated": false,
        "source": "https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1",
        "id": "CVE-2026-38429-655efb6b",
        "signature_version": "v1",
        "digest": {
            "function_hash": "323481953919937463736669170940028725469",
            "length": 1078.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "src/org/opencms/importexport/CmsImportVersion5.java"
        },
        "deprecated": false,
        "source": "https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1",
        "id": "CVE-2026-38429-656b583f",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "181059242248379036739186949021608391390",
                "147973670601283964574541985247054292952",
                "221415849426066096990887051712425454553",
                "337459723314667745362475205776367896967",
                "181556868906426691666909733990579306215",
                "278037913868309246698932749035067939230",
                "205811112067745696225392953192930172056",
                "175564781610366784375673727899214416576",
                "495030207641427856478257289104084366",
                "205753641410184498495949857856575525299",
                "73224307637468384163576952728336865551",
                "243102776978891516393007945551500994531",
                "39021436506914960625336438103559301269",
                "9382823883554512336715172214757885066",
                "20243658841510529412945612926541096186",
                "185283445785534008380812332815806960562",
                "308407306302046910333601346883091611005",
                "72556814150170722067127042214809249759",
                "43814319413669785550600424258384575863"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "src/org/opencms/importexport/CmsImportVersion4.java"
        },
        "deprecated": false,
        "source": "https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1",
        "id": "CVE-2026-38429-6d418702",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "181059242248379036739186949021608391390",
                "147973670601283964574541985247054292952",
                "221415849426066096990887051712425454553",
                "337459723314667745362475205776367896967",
                "181556868906426691666909733990579306215",
                "278037913868309246698932749035067939230",
                "205811112067745696225392953192930172056",
                "175564781610366784375673727899214416576",
                "270064422986870007225845663921307750895",
                "205753641410184498495949857856575525299",
                "73224307637468384163576952728336865551",
                "243102776978891516393007945551500994531",
                "39021436506914960625336438103559301269",
                "9382823883554512336715172214757885066",
                "20243658841510529412945612926541096186",
                "185283445785534008380812332815806960562",
                "75611659833126041066799616841059377336",
                "250505799595875241910171462188818615271",
                "215408660540593556582947204667459396371"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "src/org/opencms/importexport/CmsImportVersion2.java",
            "function": "importData"
        },
        "deprecated": false,
        "source": "https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1",
        "id": "CVE-2026-38429-834c5d8e",
        "signature_version": "v1",
        "digest": {
            "function_hash": "12226235277250738998025490039307120906",
            "length": 1637.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "src/org/opencms/importexport/CmsImportVersion2.java",
            "function": "mergePageFile"
        },
        "deprecated": false,
        "source": "https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1",
        "id": "CVE-2026-38429-bec2b405",
        "signature_version": "v1",
        "digest": {
            "function_hash": "120894723339182231600175419956008544586",
            "length": 4956.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "src/org/opencms/importexport/CmsImportVersion2.java"
        },
        "deprecated": false,
        "source": "https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1",
        "id": "CVE-2026-38429-cec32557",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "279804039993241807417941060248349660326",
                "56744153475790451898074080963054278278",
                "249466267802660174160066781099542776146",
                "331924858928345494486341486605572166778",
                "181556868906426691666909733990579306215",
                "278037913868309246698932749035067939230",
                "205811112067745696225392953192930172056",
                "175564781610366784375673727899214416576",
                "289360280611485728570254877855436204843",
                "295790348673944489166275768873937990543",
                "298793317334150000321843208433361217181",
                "15762109856477001922803046846564678650"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "src/org/opencms/importexport/CmsXmlPageConverter.java",
            "function": "convertToXmlPage"
        },
        "deprecated": false,
        "source": "https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1",
        "id": "CVE-2026-38429-e44620d1",
        "signature_version": "v1",
        "digest": {
            "function_hash": "278686140696494030632290966608204747039",
            "length": 1697.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "src/org/opencms/importexport/CmsImportVersion3.java"
        },
        "deprecated": false,
        "source": "https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1",
        "id": "CVE-2026-38429-fa70a33c",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "105917874054993401105767442443425640210",
                "84783280077536608044989516684238732562",
                "168855807753060455629373850837136089259",
                "331924858928345494486341486605572166778",
                "181556868906426691666909733990579306215",
                "278037913868309246698932749035067939230",
                "205811112067745696225392953192930172056",
                "175564781610366784375673727899214416576"
            ],
            "threshold": 0.9
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-38429.json"